re: smsc95xx: detect chip revision specific features

re: smsc95xx: detect chip revision specific features

[Dan Carpenter]

Hello Steve Glendinning,

The patch 9ebca5071c86: "smsc95xx: detect chip revision specific 
features" from Nov 22, 2012, leads to the following warning:
drivers/net/usb/smsc95xx.c:1349 smsc95xx_suspend()
	 error: buffer overflow 'filter_mask' 8 <= 31

drivers/net/usb/smsc95xx.c
  1283          if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
  1284                  u32 *filter_mask = kzalloc(32, GFP_KERNEL);
                                                   ^^
We allocate 8 unsigned 32 bit values.  I think this is the mistake here
actually.  It is a typo and should say:

			u32 *filter_mask = kzalloc(sizeof(u32) * 32, GFP_KERNEL);

If 8 elements was the intent then that's nasty.

  1285                  u32 command[2];
  1286                  u32 offset[2];
  1287                  u32 crc[4];
  1288                  int wuff_filter_count =
  1289                          (pdata->features & FEATURE_8_WAKEUP_FILTERS) ?
  1290                          LAN9500A_WUFF_NUM : LAN9500_WUFF_NUM;

LAN9500A_WUFF_NUM is 8.  LAN9500_WUFF_NUM is 4.

  1291                  int i, filter = 0;
  1292  

[snip]

  1348                  for (i = 0; i < (wuff_filter_count * 4); i++) {
                                         ^^^^^^^^^^^^^^^^^^^^^

We are either counting to 15 or 31, and both are more that 8.

  1349                          ret = smsc95xx_write_reg_nopm(dev, WUFF, filter_mask[i]);
                                                                         ^^^^^^^^^^^^^^
So we're going past the end of the 8 element array.

  1350                          if (ret < 0)
  1351                                  kfree(filter_mask);
  1352                          check_warn_return(ret, "Error writing WUFF\n");
  1353                  }

regards,
dan carpenter

Re: smsc95xx: detect chip revision specific features

[Steve Glendinning]

Hi Dan,

> drivers/net/usb/smsc95xx.c
>   1283          if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
>   1284                  u32 *filter_mask = kzalloc(32, GFP_KERNEL);
>                                                    ^^
> We allocate 8 unsigned 32 bit values.  I think this is the mistake here
> actually.  It is a typo and should say:
>
>                         u32 *filter_mask = kzalloc(sizeof(u32) * 32, GFP_KERNEL);
>
> If 8 elements was the intent then that's nasty.

Good spot!  8 32-bit elements was the intent, but all the following
code is actually accessing it using what should be byte offsets.  So I
think this should read:

    u8 *filter_mask = kzalloc(32, GFP_KERNEL);

The rest of the code following makes sense then, up until:

>   1349                          ret = smsc95xx_write_reg_nopm(dev, WUFF, filter_mask[i]);

Which we'll need to change so it dereferences a u32 at that offset
instead of a u8, something like *((u32 *)&filter_mask[i])

If this looks good to you I'll prepare a patch?

Steve

Re: smsc95xx: detect chip revision specific features

[Dan Carpenter]

On Tue, Nov 27, 2012 at 12:32:26PM +0000, Steve Glendinning wrote:
> Hi Dan,
> 
> > drivers/net/usb/smsc95xx.c
> >   1283          if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
> >   1284                  u32 *filter_mask = kzalloc(32, GFP_KERNEL);
> >                                                    ^^
> > We allocate 8 unsigned 32 bit values.  I think this is the mistake here
> > actually.  It is a typo and should say:
> >
> >                         u32 *filter_mask = kzalloc(sizeof(u32) * 32, GFP_KERNEL);
> >
> > If 8 elements was the intent then that's nasty.
> 
> Good spot!  8 32-bit elements was the intent, but all the following
> code is actually accessing it using what should be byte offsets.  So I
> think this should read:
> 
>     u8 *filter_mask = kzalloc(32, GFP_KERNEL);
> 
> The rest of the code following makes sense then, up until:
> 
> >   1349                          ret = smsc95xx_write_reg_nopm(dev, WUFF, filter_mask[i]);
> 
> Which we'll need to change so it dereferences a u32 at that offset
> instead of a u8, something like *((u32 *)&filter_mask[i])
> 
> If this looks good to you I'll prepare a patch?
> 

Sound fine to me.  Could you give me the Reported-by: tag?

regards,
dan carpenter

Re: smsc95xx: detect chip revision specific features

[Steve Glendinning]

>> > drivers/net/usb/smsc95xx.c
>> >   1283          if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
>> >   1284                  u32 *filter_mask = kzalloc(32, GFP_KERNEL);
>> >                                                    ^^
>> > We allocate 8 unsigned 32 bit values.  I think this is the mistake here
>> > actually.  It is a typo and should say:

<snip>

On re-reading the datasheet we *do* need 32 u32's here so you were
right the first time!  Patch on its way shortly.

Steve